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STATEMENT OF CASE 

Appellants appeal under 35 U.S.C. § 134(a) from a Final Rejection of 
claims 1, 2, 4-8, 10-16, 18-21, 23-27, 29-35, 37-40, 43, and 45-51. 2 We 
have jurisdiction under 35 U.S.C. § 6(b). 

We reverse, and enter a new ground of rejection. 

Appellants' invention relates to a method and apparatus for reducing 
the occurrence of unauthorized use of on-line resources of a plurality of 
companies. A dynamic profile is created and/or updated for each 
consumer/merchant using the invention, by means of adaptive learning 
techniques. If the stored business rules for the company identified as 
associated with the requested on-line resource specify that authentication is 
required, indicia of physical identification are obtained from the user and 
compared to stored indicia. The request for on-line resources is fulfilled only 
if the obtained indicia match the stored indicia (Spec. 4, 8). 

Claim 1 is exemplary of the claims on appeal: 

1 . A method for reducing the occurrence of unauthorized use of on- 
line resources, comprising: 

storing business roles for a plurality of companies having on-line 
resources; 

receiving a message indicating a request from a user to use on-line 
resources; 

identifying a company associated with the requested on-line resource 
from among the plurality of companies; 

retrieving the stored business rules for the identified company; 

determining whether the request requires authentication; 

enabling the request to be fulfilled without authentication if the 
determination indicates that authentication is not required; 

obtaining an indicia of physical identification from the user if the 
determination instead indicates that authentication is required; 



2 Claims 3, 9, 17, 22, 28, 36, 41, 42, and 44 have been cancelled. 
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comparing the obtained indicia to a stored indicia for the user; and 
enabling the request to be fulfilled if the obtained indicia matches the 
stored indicia, 

wherein the step of determining whether the request requires 
authentication includes determining whether stored business rules for the 
identified company associated with the requested on-line resource indicates 
that authentication for the user is required. 

The Examiner relies upon the following prior art in rejecting the 

claims on appeal: 

Blonder US 5,708,422 Jan. 13, 1998 

Viavant US 5,784,566 Jul. 21, 1998 

Baulier US 6,157,707 Dec. 5, 2000 

Spiegel US 6,466,9 1 8 B 1 Oct. 1 5 , 2002 

Pereira,III US 6,931,402 Bl Aug. 16, 2005 

Claims 1, 4-6, 18-20, 23-25, 37-39, and 45 stand rejected under 35 

U.S.C. § 103(a) as being unpatentable over Pereira in view of Viavant. 

Claims 2, 7, 8, 21, 26, 27, 40, and 43 stand rejected under 35 U.S.C. 

§ 103(a) as being unpatentable over Pereira in view of Viavant and Baulier. 
Claims 10-16 and 29-35 stand rejected under 35 U.S.C. § 103(a) as 

being unpatentable over Pereira in view of Viavant and Blonder. 

Claims 46-51 stand rejected under 35 U.S.C. § 103(a) as being 

unpatentable over Pereira in view of Viavant, Baulier, and Spiegel. 

Throughout this decision, we make reference to the Appeal Brief 

("App. Br.," filed September 25, 2006), the Reply Brief ("Reply Br.," filed 

February 6, 2007) and the Examiner's Answer ("Ans.," mailed December 8, 

2006) for their respective details. 
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ISSUE 

Appellants argue that Pereira does not teach or suggest: storing 
business rules for a plurality of companies; identifying a company associated 
with the requested on-line resource from among the plurality of companies; 
retrieving stored business rules for the identified company; or determining 
whether stored business rules for the identified company associated with the 
requested on-line resource indicate that authentication for the user is 
required (App. Br. 7). The Examiner finds that these limitations are met by 
Pereira, because Pereira teaches controlling access per company. Pereira 
teaches storing rules controlling access to a specific group of objects; 
Pereira' s database has the attribute "company" among many other attributes; 
and data objects may be restricted based on the "company" attribute (Ans. 7- 
8). 

Appellants' contentions present us with the following issue: 
Have Appellants shown that the Examiner erred in finding that Pereira 
teaches controlling access by users to on-line resources of a plurality of 
companies, including storing business rules for a plurality of companies 
having on-line resources; identifying a company identified with a requested 
on-line resource from among the plurality of companies; retrieving the 
stored business rules for the identified company; and determining whether 
stored business rules for the identified company associated with the 
requested on-line resource indicate that authentication for the user is 
required? 
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FINDINGS OF FACT 
The following Findings of Fact (FF) are shown by a preponderance of 
the evidence. 

The Invention 

1. According to Appellants, they have invented a method and 
apparatus for reducing the occurrence of unauthorized use of on-line 
resources of a plurality of companies. A dynamic profile is created and/or 
updated for each consumer/merchant using the invention, by means of 
adaptive learning techniques. If the stored business rules for the company 
identified as associated with the requested on-line resource specify that 
authentication is required, indicia of physical identification are obtained 
from the user and compared to stored indicia. The request for on-line 
resources is fulfilled only if the obtained indicia match the stored indicia 
(Spec. 4, 8). 

Pereira 

2. Pereira teaches providing an extranet user access to an object 
located in a foreign intranet (col. 3, 11. 20-21). 

3. To reduce the replication of profile records across intranets, the 
inventive profiling database may include records for users from different 
companies (col. 3, 11. 24-28). 

Viavant 

4. Viavant teaches system and method for selecting and initiating 
security services (i.e., authentication) for communication across computer 
networks (Abstract). 
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Baulier 

5. Baulier teaches reducing fraud losses by invoking one or more 
authentication measures based on a fraud score that indicates the likelihood 
of fraud for that particular call or previously stored calls (Abstract). 

Blonder 

6. Blonder teaches an automated method for alerting a customer 
that a transaction is being initiated and for authorizing the transaction based 
on a confirmation/approval by the customer thereto (Abstract). 

Spiegel 

7. Spiegel teaches a computer-implemented method for 
identifying popular nodes within a browse tree or other hierarchical browse 
structure based on historical actions of online users, and for calling such 
nodes to the attention of users during navigation of the browse tree 
(Abstract). 

PRINCIPLES OF LAW 
On the issue of obviousness, the Supreme Court has stated that "the 
obviousness analysis cannot be confined by a formalistic conception of the 
words teaching, suggestion, and motivation." KSR Int'l Co. v. Teleflex Inc., 
550 U.S. 398, 419 (2007). Further, the Court stated "[t]he combination of 
familiar elements according to known methods is likely to be obvious when 
it does no more than yield predictable results." Id. at 416. "One of the ways 
in which a patent's subject matter can be proved obvious is by noting that 
there existed at the time of the invention a known problem for which there 
was an obvious solution encompassed by the patent's claims." Id. at 419- 
420. 
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The Supreme Court . . . has enunciated a definitive test to 
determine whether a process claim is tailored narrowly enough 
to encompass only a particular application of a fundamental 
principle rather than to pre-empt the principle itself. A claimed 
process is surely patent-eligible under § 101 if: (1) it is tied to a 
particular machine or apparatus, or (2) it transforms a particular 
article into a different state or thing. See Benson, 409 U.S. [63] 
70, 93 S.Ct. 253 ("Transformation and reduction of an article 'to 
a different state or thing' is the clue to the patentability of a 
process claim that does not include particular machines."); 
Diehr, 450 U.S. [175] 192, 101 S.Ct. 1048 (holding that use of 
mathematical formula in process "transforming or reducing an 
article to a different state or thing" constitutes patent-eligible 
subject matter); see also Flook, 437 U.S. [584] 589 n.9, 98 
S.Ct. 2522 ("An argument can be made [that the Supreme] 
Court has only recognized a process as within the statutory 
definition when it either was tied to a particular apparatus or 
operated to change materials to a 'different state or thing'"); 
Cochrane v. Deener, 94 U.S. 780, 788, 24 L.Ed. 139 (1876) ("A 
process is ... an act, or a series of acts, performed upon the 
subject-matter to be transformed and reduced to a different state 
or thing."). 

In re Bilski, 545 F.3d 943, 954 (Fed. Cir. 2008) (footnote omitted). 

The machine-or-transformation test is a two-branched inquiry; 
an applicant may show that a process claim satisfies § 101 
either by showing that his claim is tied to a particular machine, 
or by showing that his claim transforms an article. See Benson, 
409 U.S. at 70, 93 S.Ct. 253. Certain considerations are 
applicable to analysis under either branch. First, as illustrated 
by Benson and discussed below, the use of a specific machine 
or transformation of an article must impose meaningful limits 
on the claim's scope to impart patent-eligibility. See Benson, 
409 U.S. at 71-72, 93 S.Ct. 253. Second, the involvement of the 
machine or transformation in the claimed process must not 
merely be insignificant extra- solution activity. See Flook, 437 
U.S. at 590, 98 S.Ct. 2522. 

Id., 545 F.3d at 961-62. 
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ANALYSIS 

Section 103 rejection of claims 1, 4-6, 18-20, 23-25, 37-39, and 45 
Claims 1, 20, and 39 constitute all the independent claims in this 
application. Each independent claim recites method or apparatus for: (1) 
storing business rules for a plurality of companies having on-line resources; 
(2) identifying a company associated with the requested on-line resource 
from among the plurality of companies; (3) retrieving the stored business 
rules for the identified company; and (4) determining whether the stored 
business rules for the identified company associated with the requested on- 
line resource indicate that authentication for the user is required. 

In concluding that the combination of Pereira and Viavant renders the 
claimed invention obvious, the Examiner finds that Pereira teaches access to 
a specific group of objects (Ans. 7); that the access control rules of Pereira 
are stored associating a company with a requested online resource from 
among a plurality of companies [A, B, or C] (Ans. 8); and that while Pereira 
teaches that the rules are applied to users, they are also the rules for the 
companies involved (Ans. 8). The Examiner further finds that Viavant 
teaches determining if authentication is required, and "authentication 
methods in" (Ans. 9). 

We do not agree with the Examiner's findings that Pereira and 
Viavant, taken together, teach all the limitations of claims 1, 20, and 39. 
Broadly stated, the instant invention is concerned with receiving requests for 
the use of on-line resources which may correspond to any one of a plurality 
of different companies, determining for each request whether the business 
rules corresponding to that particular company require user authentication, 
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and if so performing such user authentication. Pereira, on the other hand, is 
directed to providing an extranet user access to an object located in a foreign 
intranet (FF 2). Pereira is concerned with who may be granted access to a 
single company's data; those granted access may be internal or external to 
that single company. To reduce the replication of profile records across 
intranets, the inventive profiling database may include records for users 
from different companies (FF 3; emphasis added). The Examiner correctly 
finds that Pereira teaches a database having a "Company" attribute (Ans. 7; 
Pereira Fig. 1). However, that attribute is attached to each of a plurality of 
users, rather than a plurality of stored data objects to be accessed by users. 
The Examiner's finding that Pereira teaches access to an online resource 
"from among a plurality of companies" (Ans. 8) is erroneous. The 
Examiner's statement that an online resource may be associated with 
"company A, B, or C" (Ans. 8) lacks support in the record. We have 
reviewed Pereira and find no teaching that the on-line resources therein may 
be associated with one of a plurality of companies. 

Thus, we find that Pereira lacks a teaching of on-line resources 
corresponding to a plurality of companies. Because Pereira is directed to 
managing a single company's data, Pereira necessarily lacks a teaching of 
identifying which company corresponds to a particular resource request; 
retrieving the business rules for the identified company; or determining 
whether authentication is required before granting access to the identified 
company's resources. 

Because Pereira lacks a teaching of the claim limitations discussed 
supra, we find error in the Examiner's prima facie case of obviousness over 
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Pereira in view of Viavant. Therefore, we will not sustain the rejection of 
claims 1, 4-6, 18-20, 23-25, 37-39, and 45 under § 103. 

Claims 2, 7, 8, 21, 26, 27, 40, and 43 

As explained supra, we reversed the rejection of claims 1, 20, and 39, 
from which claims 2, 7, 8, 21, 26, 27, 40, and 43 variously depend. We have 
reviewed Baulier, and find that it does not remedy the deficiencies noted 
with respect to the combination of Pereira and Viavant. Thus, we will not 
sustain the rejection of claims 2, 7, 8, 21, 26, 27, 40, and 43 under § 103, for 
the same reasons given with respect to claims 1, 20, and 39, supra. 
Claims 10-16 and 29-35 

As explained supra, we reversed the rejection of claims 1 and 20, 
from which claims 10-16 and 29-35 variously depend. We have reviewed 
Blonder, and find that it does not remedy the deficiencies noted with respect 
to the combination of Pereira and Viavant. Thus, we will not sustain the 
rejection of claims 10-16 and 29-35 under § 103, for the same reasons given 
with respect to claims 1 and 20, supra. 

Claims 46-51 

As explained supra, we reversed the rejection of claims 1, 20, and 39, 
from which claims 46-51 variously depend. We have reviewed Baulier and 
Spiegel, and find that they do not remedy the deficiencies noted with respect 
to the combination of Pereira and Viavant. Thus, we will not sustain the 
rejection of claims 46-51 under § 103, for the same reasons given with 
respect to claims 1, 20, and 39, supra. 

New Grounds of Rejection of claim 1 

We make the following new grounds of rejection using our authority 
under 37 C.F.R. § 41.50(b). 
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Claim 1 is rejected under 35 U.S.C. § 101 as being directed to non- 
statutory subject matter. 

We have reviewed the steps recited in method claim 1 and find that 
none of the steps tie the method to a particular machine or apparatus. We 
further find that the method of claim 1 does not transform an article into a 
different state or thing. We therefore find that claim 1 is not tailored 
narrowly enough to encompass only a particular application of a 
fundamental principle rather than to pre-empt the principle itself. Bilski, 545 
F.3d at 954. Thus, we conclude that claim 1 is directed to non-statutory 
subject matter under § 101. 

Although we decline to reject every claim under our discretionary 
authority under 37 C.F.R. 41.50(b), we emphasize that our decision does not 
mean the remaining claims are patentable. Rather, we merely leave the 
patentability determination of the remaining claims to the Examiner. See 
MPEP § 1213.02. 

CONCLUSIONS OF LAW 
Appellants have shown that the Examiner erred in finding that Pereira 
teaches controlling access by users to on-line resources of a plurality of 
companies, including storing business rules for a plurality of companies 
having on-line resources; identifying a company identified with a requested 
on-line resource from among the plurality of companies; retrieving the 
stored business rules for the identified company; and determining whether 
stored business rules for the identified company associated with the 
requested on-line resource indicate that authentication for the user is 
required. 
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ORDER 

The Examiner's rejection of claims 1, 2, 4-8, 10-16, 18-21, 23-27, 29- 
35, 37-40, 43, and 45-51 is reversed. 

We have also entered a new ground of rejection against claim 1 under 
37 C.F.R. § 41.50(b). 

37 C.F.R. § 41.50(b) provides that, "[a] new grounds of rejection 
pursuant to this paragraph shall not be considered final for judicial review." 

37 C.F.R. § 41.50(b) also provides that the Appellants, WITHIN TWO 
MONTHS FROM THE DATE OF THE DECISION, must exercise one of the 
following two options with respect to the new grounds of rejection to avoid 
termination of proceedings (37 C.F.R. § 1.197 (b) as to the rejected claims: 

(1) Submit an appropriate amendment of the claims so rejected or 
new evidence relating to the claims so rejected, or both, and have the matter 
reconsidered by the examiner, in which event the proceeding will be 
remanded to the examiner . . . 



(2) Request that the proceeding be reheard under 37 C.F.R. § 41.52 
by the Board upon the same record . . . 

No time period for taking any subsequent action in connection with 
this appeal may be extended under 37 C.F.R. § 1.1.36(a). 
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REVERSED 
37 C.F.R. § 41.50(b) 



ELD 



PILLSBURY, WINTHROP, SHAW, PITTMAN, LLP 
P.O. BOX 10500 
MCLEAN, VA 22102 
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